[patch] Patch to replace MD5 with an EVP implementation of SHA1

fips_permitted_contextid.patch (text/plain), 3.72 KB, created by William A. Rowe Jr. on 2013-01-22 16:57:32 UTC

(hide)

Description: Patch to replace MD5 with an EVP implementation of SHA1

Filename:

MIME Type:

Creator: William A. Rowe Jr.

Created: 2013-01-22 16:57:32 UTC

Size: 3.72 KB

patch

obsolete

>Index: include/ssl_private.h >=================================================================== >--- include/ssl_private.h (revision 7448) >+++ include/ssl_private.h (working copy) >@@ -49,7 +49,6 @@ > #include <openssl/evp.h> > #include <openssl/rand.h> > #include <openssl/x509v3.h> >-#include <openssl/md5.h> > /* Avoid tripping over an engine build installed globally and detected > * when the user points at an explicit non-engine flavor of OpenSSL > */ >@@ -234,7 +233,7 @@ > BIO *bio_os; > BIO *bio_is; > >- unsigned char context_id[MD5_DIGEST_LENGTH]; >+ unsigned char context_id[SHA_DIGEST_LENGTH]; > > int protocol; > /* we are one or the other */ >@@ -309,7 +308,6 @@ > RSA *SSL_callback_tmp_RSA(SSL *, int, int); > DH *SSL_callback_tmp_DH(SSL *, int, int); > void SSL_callback_handshake(const SSL *, int, int); >-void SSL_vhost_algo_id(const unsigned char *, unsigned char *, int); > int SSL_CTX_use_certificate_chain(SSL_CTX *, const char *, int); > int SSL_callback_SSL_verify(int, X509_STORE_CTX *); > int SSL_rand_seed(const char *file); >Index: src/sslcontext.c >=================================================================== >--- src/sslcontext.c (revision 7448) >+++ src/sslcontext.c (working copy) >@@ -147,9 +147,9 @@ > #endif > /* Default session context id and cache size */ > SSL_CTX_sess_set_cache_size(c->ctx, SSL_DEFAULT_CACHE_SIZE); >- MD5((const unsigned char *)SSL_DEFAULT_VHOST_NAME, >- (unsigned long)(sizeof(SSL_DEFAULT_VHOST_NAME) - 1), >- &(c->context_id[0])); >+ EVP_Digest((const unsigned char *)SSL_DEFAULT_VHOST_NAME, >+ (unsigned long)(sizeof(SSL_DEFAULT_VHOST_NAME) - 1), >+ &(c->context_id[0]), NULL, EVP_sha1(), NULL); > if (mode) { > SSL_CTX_set_tmp_rsa_callback(c->ctx, SSL_callback_tmp_RSA); > SSL_CTX_set_tmp_dh_callback(c->ctx, SSL_callback_tmp_DH); >@@ -195,9 +195,9 @@ > TCN_ASSERT(ctx != 0); > UNREFERENCED(o); > if (J2S(id)) { >- MD5((const unsigned char *)J2S(id), >- (unsigned long)strlen(J2S(id)), >- &(c->context_id[0])); >+ EVP_Digest((const unsigned char *)J2S(id), >+ (unsigned long)strlen(J2S(id)), >+ &(c->context_id[0]), NULL, EVP_sha1(), NULL); > } > TCN_FREE_CSTRING(id); > } >Index: src/sslnetwork.c >=================================================================== >--- src/sslnetwork.c (revision 7448) >+++ src/sslnetwork.c (working copy) >@@ -151,7 +151,7 @@ > SSL_set_tmp_rsa_callback(ssl, SSL_callback_tmp_RSA); > SSL_set_tmp_dh_callback(ssl, SSL_callback_tmp_DH); > SSL_set_session_id_context(ssl, &(ctx->context_id[0]), >- MD5_DIGEST_LENGTH); >+ sizeof(ctx->context_id)); > } > SSL_set_verify_result(ssl, X509_V_OK); > SSL_rand_seed(ctx->rand_file); >Index: src/sslutils.c >=================================================================== >--- src/sslutils.c (revision 7448) >+++ src/sslutils.c (working copy) >@@ -404,25 +404,6 @@ > return (DH *)SSL_temp_keys[idx]; > } > >-void SSL_vhost_algo_id(const unsigned char *vhost_id, unsigned char *md, int algo) >-{ >- MD5_CTX c; >- MD5_Init(&c); >- MD5_Update(&c, vhost_id, MD5_DIGEST_LENGTH); >- switch (algo) { >- case SSL_ALGO_UNKNOWN: >- MD5_Update(&c, "UNKNOWN", 7); >- break; >- case SSL_ALGO_RSA: >- MD5_Update(&c, "RSA", 3); >- break; >- case SSL_ALGO_DSA: >- MD5_Update(&c, "DSA", 3); >- break; >- } >- MD5_Final(md, &c); >-} >- > /* > * Read a file that optionally contains the server certificate in PEM > * format, possibly followed by a sequence of CA certificates that View Attachment As Diff View Attachment As Raw

This is ASF Bugzilla: the Apache Software Foundation bug system. In case of problems with the functioning of ASF Bugzilla, please contact bugzilla-admin@apache.org. Please Note: this e-mail address is only for reporting problems with ASF Bugzilla. Mail about any other subject will be silently ignored.

• • Home
  • | New
  • | Browse
  • | Search
  • |
    [?]
  • | Reports
  • | Help
  • | New Account
  • | Log In
    Remember [x]
  • | Forgot Password
    Login: [x]